APPLE-SA-2017-12-12-1 AirPort Base Station Firmware Update 7.6.9

[Apple Product Security <product-security-noreply () lists apple com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

APPLE-SA-2017-12-12-1 AirPort Base Station Firmware Update 7.6.9

AirPort Base Station Firmware Update 7.6.9 is now available and
addresses the following:

AirPort Base Station Firmware
Available for: AirPort Express, AirPort Extreme, and
AirPort Time Capsule base stations with 802.11n
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
unicast/PTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13077: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
CVE-2017-13078: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven

AirPort Base Station Firmware
Available for: AirPort Express, AirPort Extreme, and
AirPort Time Capsule base stations with 802.11n
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven

Installation note:

Firmware version 7.6.9 is installed on AirPort Express, AirPort
Extreme, or AirPort Time Capsule base stations with 802.11n using
AirPort Utility for Mac or iOS.

AirPort Utility for Mac is a free download from
https://support.apple.com/downloads/ and AirPort Utility for iOS
is a free download from the App Store.
-----BEGIN PGP SIGNATURE-----

iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlowGBMpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEat/hAA
oSRiOLRhqL1ou4QBFooxDYnYpgEQHCWwyMFcRwSATzVEyGFNS95AWG1kzVM7g/FE
7O81zzw33Zlk7YhjeGwlpPQ0QG6x1FD/kVi4kFPEakJE0u514zn+LvD+1ZZ/1oan
jpsw1APUSOqKiTFpFLM2A+te5pt0j6VrObYykWZpyxoMqqBTxRBhA/44NZMmZKtP
FEKLi9wfV7VuiyJbvjKomvAmJXAWY/lOWF0r/+7EWni0c6s3P8IpgliSYaCzlHSD
5T4Rr1xFEEMAU8LcMI5MYh5MUGkXoMgNCdGpHcKGAH6IeFLHLcNQgzHvQHI4M4zE
aqKxh0QuriXCCT45eTtAJfpNzKd/Ei2Df9BlmgDZX1U4pt4FgKTar0DhtQtw8rwA
0A6LHAiKWRxS9OJjQQeBKcNM6ZXkCIDESku8gEXdxaM2H82zQ4EJVYZ9C1e0EOGp
fF2jPTfaVMutQuoEpGn65hlQxi/szh/ezwGNKUTRAicTInaBPGFGRAr0+xiXVdi7
0Bb/i+hTIC2FKPaOWfLBIBbedu3M9oIi0061q3YukZPlESiZGUWyGDmyoX/3ZIht
anDY6u6IDzmqu5Sw/llZAsFkFsFwNJMioVOgNceXeetSAiXCHqsWBQFnw3Q4tJgS
9kPiorTFjAJYFQwPdPhFGaxwT+bDqgKi9g82QrGniVc=
=QykH
-----END PGP SIGNATURE-----


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/